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[57] ABSTRACT 

A method and a system for managing a data object so as to 
comply with predetermined conditions for usage of the data 
objeci. To control the usage of the data object, a set of 
control data, denning uses of ihe data object, which comply 
with the predetermined conditions, is created for the data 
object. The data objeci is concatenated with the user set of 
control data, encrypted and transferred to the user. When the 
user wants to use the data object, a special user program 
checks whether the usage complies with the control data. If 
so, the usage is enabled. Otherwise it is disabled. 
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METHOD AND SYSTEM FOR MANAGING A 
DATA OBJECT SO AS TO COMPLY WITH 
PREDETERMINED CONDITIONS FOR 
USAGE 

TECHNICAL FIELD 

Tbe present invention relates to data processing and more 
particularly to a method and a system for managing data 
objects so as to comply with predetermined conditions for 
usage. 

BACKGROUND 

Much has beeD written recently regarding the puzzle of 
universal connectivity. A typical vision of the data highway 
has long distance high speed data carriers inter connecting 
regional networks which provide telecommunications ser- 
vices and a wide range of interactive on-line services to 
consumers. Many of the pieces are already in place, others 
are in development or testing. In fact, even though the data 
highway is under construction it is currently open to limited 
traffic. On-line services are springing up daily and video on 
demand services are currently being tested. 

The potential to benefit society is immense. The scope of 
information available to consumers will become truly global : 
as the traditional barriers to entry for distribution of, and 
access 10, information are lowered dramatically. This means 
that more diverse and specialized information will be made 
available just as conveniently as generic sources from major 
vendors used to be. The end result is that organizations and 
individuals will be empowered in ways heretofore only 
imagined. 

However, a fully functioning data highway will only be as 
valuable as the actual services which it provides. Services 
envisioned for the data highway that involve the delivery of 
data objects (e.g. books, films, video, news, music, software, 
games, etc.) will be and are currently limited by the avail- 
ability of such objects. Library and educational services arc 
similarly affected. Before owners will allow their data 
objects to be offered they must be assured of royalty 
payments and protection from piracy. 

Encryption is a key component of any solution to provide 
copy protection. But encryption alone is not enough. During 
transmission and storage the data objects will be protected 
by encryption, but as soon as anyone is given the key to 
decipher the content he will have unlimited control over it. 
Since the digital domain permits data objects to be repro- 
duced in unlimited quantities with no loss of quality, each 
object will need to be protected from unlimited use and 
unauthorized reproduction and resale. 

The protection problem must not be solved by a separate 
solution for each particular data formal, because then the 
progress will indeed be slow. It is important to consider the 
effect of standardization on an industry. Consider how the 
VHS, the CD and the DAT formats', and the IBM PC 
compatibility standards have encouraged growth in their 
respective industries. However, if there is to be any type of 
standardization, the standard must provide universal adapt- 
ability to the needs of both data providers and data users. 

Tbe data object owner may want to have permanent 
secure control over how, when, where, and by whom his 
property is used. Furthermore, he may want to define 
different rules of engagement for different types of users and 
different types of security depending on the value of par- 65 
ticular objects. The rules defined by him shall govern the 
automated operations enabled by data services and network - 
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ing. Tne owner may also want to sell composite objects with 
different rules governing each constituent object. Thus, it is 
necessary to be able to implement variable and extensible 
control. 

The user on his pan wants to be able to search for and 
purchase data objects in a convenient manner If desired, the 
user should be able to combine or edit purchased objects (i.e. 
for creating a presentation). Furthermore, the user may want 
to protect his children from inappropriate material. A com- 
plete solution must enable these needs as well. 

What is needed is a universally adaptable system and 
method for managing the exchange and usage of data objects 
while protecting the interests of data object owners and 
users. 

PRIOR ART 

A method for enforcing payment of royalties when copy- 
ing softcopy books is described in the European patent 
application EP 0 567 800. This method protects a formatted 
text stream of a structured document which includes a 
royally payment element having a special tag. When the 
formatted text stream is inputted in the user's data processor, 
the text stream is searched to identify the royalty payment 
element and a flag is stored in the memory of the data 
processor. When the user for instance requests to print the 
document, the data processor requests authorization for this 
operation from a second data processor. The second data 
processor charges the user the amount indicated in the 
royalty payment element and then transmits tbe authoriza- 
tion to the first data processor. 

One serious limitation of this method is that it can only be 
applied to structured documents. The description of the 
above-mentioned European patent application defines a 
structured document as: a document prepared in accordance 
with an SGML compliant type definition. In other words it 
can not be applied to documents which are not SGML 
compliant and it cannot be applied to any other types of data 
objects. 

Furthermore, this method does not provide for variable 
and extensible control. Anyone can purchase a softcopy 
book on a CD, a floppy disc or the like, and the same royally 
amount is indicated in the royalty payment element of all 
softcopy books of the same title. 

Thus, the method described in EP 0 567 800 does not 
satisfy the above-mentioned requirements for universally 
adaptable protection of data objects. 

SUMMARY OF THE INVENTION 
Accordingly, it is a first object of the invention to provide 
a method and a data processing system for managing a data 
object in a manner that is independent of the formal and the 
structure thereof, so as to comply with predetermined con- 
ditions for usage control and royalty payment. 

It is a further object of the invention to provide such a 
method and system which is universally adaptable to the 
needs of both the owner and the user of the data object. 

A further object of the invention is to provide such a 
method and system which enables a data object provider to 
distribute his data object while maintaining control of the 
usage thereof. 

Yet another object of the invention is to provide a method 
and system which allows a data object provider to select the 
level of security for his data object in a flexible way. 

Yet another object of the invention is to provide such a 
method and system which makes it possible to establish an 
audit trail for the data object. 
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Yet another object is to provide such a method and system control data. In the latter case, the number of usages 

which makes it possible to sell and buy data objects in a requested by the user is tentatively authorized and included 

secure way. in the user set, but if the request is refused the user set is 

More particularly, a data object provider, e.g., the owner canceled or changed, 

of a data object or his agent (broker), stores the data object 5 foe data package may be transferred to the user by 

in a memory device, e.g. a bulk storage device, where it is electronic means or stored on bulk storage media and 

accessible by means of the data provider's data processor. transferred to the user by mail or by any suitable transpor- 

The data object can consist of digital data, analog data or a tation means. 

combination or hybrid of analog and digital data. Once the data object has been packaged in the above - 

A general set of control data, which is based on the 10 described manner, it can only be accessed by a user program 

predetermined conditions for usage of the data object, is which has built-in usage control and means for decrypting 

created and stored in the same memory device as the data the data package. The user program will only permit usages 

object or another memory device where it is accessible by defined as acceptable in the control data. Moreover, if the 

the data provider's data processor. The predetermined con- control data comprises a security control element, the secu- 

ditions for usage may be defined by the data object owner, 15 rity procedure prescribed therein has to be complied with. In 

by the broker or by anyone else. They may differ, between one embodiment, the usage control may be performed as 

different data objects. follows. If the user decides to use a data object, the user 

The general set of control data comprises at least one or program checks the control data to see if this action is 

more usage control elements, which define usages of the authorized. More particularly, it checks that the number of 

data object which comply with the predetermined condi- 20 authorized usages of this kind is one or more. If so, the 

lions. These usages may encompass for instance the kind of action is enabled and the number of authorized usages 

user, a lime limit for usage, a geographical area for usage, decremented by one. Otherwise, the action is interrupted by 

allowed operations, such as making a hard copy of the data toe user program and the user may or may not be given the 

object or viewing it, and/or claim to royalty payment. The opportunity to purchase the right to complete the action, 

general set of control data may comprise other kinds of 25 After the usage, the user program repackages the data 

control elements besides the usage control element. In a object in the same manner as it was packaged before, 

preferred embodiment, the general set of control data com- When a data object is redistributed by a user or a broker, 

prises a security control element which defines a security new control elements are added in the control data to reflect 

procedure which has to be carried out before usage of the the relation between the old user/broker and the new user/ 

data object. It also comprises an identifier, which uniquely broker. In this way, an audit trail for the data object may be 

identifies the general set of control data. created. 

The general set of control data is concatenated with a copy According to another aspect of the invention at least two 

of the data object. Thus, the control data does not reside in data packages are stored on a user's data processor, which 

the data object, but outside it, which makes the control data 35 examines the usage control elements of the data packages in 

independent of the format of and the kind of data object and * order to find a match. If a match is found, the user's data 

which allows for usage control independently of the data processor carries out an action which is specified in the user 

object format. se t 0 f control data. This method can be used for selling and 

At least the usage control element(s) and the data object buying data objects, 

are encrypted, so that the user isunable louse the data object < 0 BRIEF DESCRIPTION OF DRAWINGS 
without a user program which performs the usage control 

and which decrypts the data object. Alternatively, the whole FIG. 1 is a flow diagram showing the general data flow 

set of control data and the copy of the data object may be according to the invention. 

encrypted. FIG. 2 is a system block diagram of a data object 

A user may request authorization for usage of a data 45 provider's data processor, 

object residing at a data provider's processor via a data FIG. 3 is a block diagram showing the different modules 

network or in any other appropriate way. The authorization of a data packaging program according to the invention, 

may or may not require payment. When a request for FIG. 4 is a data flow diagram of a data packaging process, 

authorization for usage is received, a user set of control data FIG. 5 is an example of a header file, 

is created by ihe data provider's processor. The user set of so FIG 6 is an example of a usage data file 

control data comprises the genera] set of control data or a ^G. 7 is a data flow diaeram of loading an object to ihe 

subset thereof including a. least one of said usage control daU object ider > s d ata>ocessor. 

elements which is relevant for the actual user. It typically r-t^c-o ^ol 1 r . 1 j . r 

.... ,. , . .. r/ ,/ FIGS. 8a and 8b are examples of control data for a data 

also includes a new identifier which uniquely identifies this , . . . . . . . . * , , # , r 

c . , j . ir 1 , . u . r ij object on the data object provider s data processor and for an 

set of control data. If relevant, the user set of control data 55 . * . . . J ■ j. . , 

. * j- .- r .u l. r object ready to be transferred to a user, respectively. 

also comprises an indication of the number of usages i. ¥jr , A . , a r . , - 

authorized. If more than one kind of usage is authorized, the , FIG - 9 15 a dal f ^ d,a ^ ram of dala P acka S in S on the 

number of each kind of usage may be specified. Finally, the data ^J^ 1 P rov,dcr s dala Pressor, 

user set of control data is concatenated with a copy of the F1G - 10 1S a flow d i a S ram of a data packaging procedure, 

data object, and at least the usage control elements and the 6 0 FIG - 11 is 3 memor y image of a data object and its control 

copy of the data object are encrypted to create a secure data dala - 

package ready for transfer to the user. FIG. 12a is a memory image of the concatenated control 

Before the data package is transferred to the user, it should data aDd data object, 

be confirmed that the request for authorization for usage has FIG. 12b is a memory image of the concatenated and 

been granted. The check is preferably carried out before the 65 encrypted control dala and dala object, 

user set of control data is created. However, it can also be FIG. 13 is a system block diagram of a user's dala 

carried out in parallel with or after the creation of the user processor. 
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FIG. 14 is a block diagram showing the different modules The Daia Provider's Data Processor 
of a user program according to the invention. FIG. 2 is a system block diagram of a data object 

FIG. 15 is a flow diagram of using a data object on the provider's data processor. As mentioned above, the data 
user's data processor. object provider may be an author of a data object,' an owner 

FIG. 16 is a flow diagram of how the user program 5 of a data object, a broker of a data object or anyone else who 
operates in a speciflc application example. wants to distribute a data object, while retaining the control 

FIG. 17 is an example of various data package structures °f ^ usage. The data processor is a general or special 
for composite objects. purpose processor, preferably with network capabilities. It 

DESCRIPTION OF THE BEST MODE FOR comprises a CPU 10, a memory 11 and a network adapter 12 : 

CARRYING OUT INVENTION 10 are imercpnnec,ed b >' 2 bus ^ As shown in FIG. 2, 

other conventional means, such as a display 14, a keyboard 
General Overview 15, a printer 16. a bulk storage device 17, and a ROM IS. 

FIG. 1 is a flow diagram showing the general data flow ma y a,so be connected to the bus 13. The memory U stores 
according to the invention. The flow diagram is divided into network and telecommunications programs 21 and an oper- 
a data object provider part 1 and a user pari 2. 15 a!in S system (OS) 23. All the above-mentioned elements are 

In the data object provider part 1, a data object 24 is wcll * known 10 lhc skined P erson and commercially avail, 
created by an author. The data object can consist of digital able * For lhe P ur P ose of ,ne P rese m invention, the memory 
data, analog data or a combination or hvbrid of analog and 11 aIso stores a data P acka S in g program 19 and, preferably, 
digital data. The primary difference between analog data a dalabase 20 intended for control data. Depending upon lhe 
objects and digital data objects is the means for storage 20 currenl °P eraUon > one or more data objects 24 can be stored 
transfer and usage. ' in ^ memory 11 as shown or in the bulk storage 17. The 

lhe author also determines the conditions 42 for the usage ^ dala P D rocessor * considered secure, 

of the data object 24 by a user. Tlie data object 24 and the ™L Dal ' Packa ^. Pro S ram: 

usage conditions 42 are input to a data packaging program , * aIa P ac * a g in S P'°S«m 19 is used for creating 

19, which creates a secure data package 40 of the daia object 25 C °T \ ' conlro}h ^ lne usa 6 e of a data object and for 
and of control data which are based on the input usage ^ka^ ^ ^ ^ ^ 3 

conditions 42. Once packaged in this way, the data object pa ° A a ^ e . - . 

can onlv be accessed by a user proeram 35 ^ Sn0Wn ,n HG 3 ' 11 ^P™** a program control 

Tk<* j n tn rtK^*/*t mi™ u a, iL ■ ■ . module 301, a user interface module 302, a packaging 

Joe data object may be packaged together wi h a general , n mi \ , i j . , ^ awva & lu e 

cM rt f^n,r rt i^», ^kL;. ,^ r 11 r.t V 30 module 303 > 3 control data creation module 304, an encryp- 

set ot control data, which is the same for al users of he data tinn „,«j„i- mc ~ r ^ * „/w . 7V 

objec. This -y be 0, e case when ,he da.a objec, is sen, ,o TJZfSZSl Z^M™" ^ ^ °" 

a retailer or a bulleliD board, wherefrom a user may obtain -n,. ,-„„.-„i ' «m . • .■_ 

it. The data object may also be packaged as a consequence ,1** "T? 1 a,e J e , xecu,10n of ,he 

of a request from a user for usage of the data object In. ha, „ T h ^ ^ T*"* 302 h>nd]tS 

case, the package may included, data which * spe 35 l"*f ™, ™ v T T^J*? 
cifically adapted to that user. This control da.a is called' a Zt lc L* r o, T, t^l " 

user sel of control da,a. I, mav for example comprise the , * h ° f" 1 ' 0 " , m °* le fonD4 ' 

i , , , , - . ■ " . „ K modules 3U6, the security modu es 307 and the encrvotion 

number of usages purchased by the user. Typically, lhe user mrtAl i* inc « »,■,. a k a . " ^"^P 110 " 

. c \ a * ml , , . . , module 3U5 as will be described more in detail below 

set of control data will be created on the basis of the general , n ^ f „ rm ,. Hlll „ c ^ oeiow 

. r . i a . • . , - . , 6 ^ 4 0 Jne lormat modules 306 comense Droeram code which 

set of control data and include at least a subset thereof A ■ a u ^. ^ ^ L T wuc » w mcn 

user se, of control data need no, always be adapted for a ^ZTn ( 2^7 V a "»» na " Ve formaI - 

specific user. All se* of con.rol da.a which are created on the ^ " ^ ? ^ * dau ""P" 88 "™ and 

basis of a eeneral se, of con.rol da.a will be called a user se, converslon n The >' be ^p.emen.ed by any appropria.e, 

„ f , . ",„„ X1 ,„ r , , . , . . , commercially available program, such as by mearis of a 

of control data. Thus, a se. of con^ol data can be a general 45 rou|jne {rom \ he PKWA £ E f nc ^ Co rap ression Librar^ 

se, in one phase and a user se. ,„ ano.her phase. fof wjndows and ^ , pa 7^ a Sll7. 

The above-menuoned da.a packaging can be earned ou, made SoflW3rt jDCOrpora ,t d> resp ec,ively. They can also be 

by die author himself by means of the da,a packaging implemenied bv cuslom designed programs 

pmgrarnl^Asanal,ernative,,he au.hor maysendhisda,a The securil y modules 307 com | rise p 

object ,10 a broker, who inputs lhe data objec. and the usage 50 req uired to implement security, such as more sophistica.ed 

conditions determined by he author to the da.a packaging encr> , plion tnan whal is ^ b , be ? n 

program 19 ,n order to create a secure package 3 The au.hor 30 5, au , horizalio n algorithms, access con,7ol and usage 

may also sdl tas da.a objec, ,o ,he broke,. In that case, the conlIol> above and be f ond the basjc stcmi ^bocm in the 

brokci probably wants to apply his own usage conditions to data package 

the data packaging program. The author may also provide JS ^ dala packaging program 19 can contain ma differ . 

the data objec. m a secure package to .be broker who enI ,ypes of bo^ forma, and securi.y modules. The program 

repackages the data object and adds further con.rol data control module 301. applies .he forma, and security mofules 

which is relevant lo his business activities. Various combi- which are requested by the data provider 

nations of the above al.ernat.ves are also conceivable. -j-^ encryption module 305 may be any appropriate 

In the user part 2 of the flow diagram, lhe secure package 60 commercially available module, such as "FileCryp," Visuai 

40 ,s received by a user, who raus, use lhe user program 35 Basic subprogram found in Crescen, Software's QuickPak 

in order to unpackage ibe secure package 40 and obtain lhe Professional for Windows — FILECRPT.BAS or a custom 

daia object in a final form 80 for usage. Af.er usage, .he dala designed encryption program 

objec. is repackaged into the secure package 40. The control dala creation module 304 ceates the control 

The different parts of the sysiern and the different steps of 65 dala for controlling the usage of the data object. An example 

the method according lo the invention will now be described of a control dala structure will be described more in detail 

in more detail. below. 
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The Control Daia: entered io the form of predetermined codes, is then passed 

The control data can be stored in a header file and a usage to the control module 301, which calls the packaging module 

data file. In a preferred embodiment; the header file com- 303 and passes the information to it. 

prises fields to store an object identifier, which uniquely The packaging module 303 calls the control data creation 

identifies the control data and/or its associated data object, 5 module 304, which first creates a header file, then creates 

a title, a format code, and a security code. The format code header data on the basis of the header information entered by 

may represent the format or position of fields in the usage the data object provider and finally stores the header data, 

data file. Alternatively, the format code may designate one or step 404-405. Then a usage data file is created, usage data 

more formal modules to be used by the data packaging created on the basis of the usage informauon entered bv the 

program or the user program. The security code may rep- io data provider, and finally the usage data is stored in the 

resent the encryption method used by the encryption module usage data file, step 406-407. 

305 or any security module to be used by the data packaging The packaging module 303 then applies any format and 

program and the user program. The header file fields will be security modules 306, 307 specified in the header file, steps 

referred to as header elements. 408-413, to the data object. 

The usage data file comprises at least one field for storing 15 Next, the packaging module 303 concatenates the usage 

data which controls usage of the data object. One or more data file and the data object and stores the result as a 

usage data fields which represent one condition for the usage temporary file, step 414. The packaging module 303 calls the 

of the data object will be referred to as a usage element. In encryption module 305, which encrypts the temporary file, 

a preferred embodiment, each usage element is defined by an step 415. The level of security will depend somewhat on the 
identifier field, e.g. a serial number, a size field, which 20 quality of the encryption and key methods used, 

specifies the size of the usage element in bytes or in any Finally, the packaging module 303 concatenates the 

other appropriate way, and a data field. header file and the encrypted temporary file and saves the 

The header elements and the usage elements are control result as a single file, step 416. This final file is the data 

elements which control all operations relating to the usage of package which may now be distributed by file transfer over 
the object. The number of control elements is unlimited. The 25 a network, or on storage media such as CDROM or diskette, 

data provider may define any number of control elements to or by some other means, 

represent his predetermined conditions of usage of the data _ 

object. The only restriction is that the data packaging fcAAMPLL 1 

program 19 and the user program 35 must have compatible ^ sample of bow the data packaging program 19 can be 
program code to handle all the control elements. This 30 used wil1 now De described with reference to FIGS. 5 and 6. 

program code resides in the packaging module and the usage ln tn ^ example the data object provider is a computer 

manager module, to be described below. graphics artist, who wants to distribute an image that can be 

Control elements can contain data, script or program code used as cn P arl > Dul onlv i° a document or file which is 

which is executed by the user program 35 to control usage packaged according to the method of the invention and 
of the related data object. Script and program code can 35 wh icb has usage conditions which do not permit further 

contain conditional statements and the like which are pro- cutting or pasting. The artist wants to provide a free preview 

cessed with the relevant object and system parameters on the °^ tDe i ma ge, but also wants to be paid on a per use basis 

user's data processor. It would also be possible to use a unless the user is willing to pay a rather substantial fee for 

control element to specify a specific proprietary user pro- unlimited use. The artist will handle payment and usage 
gram which can only be obtained from a particular broker. 40 authorization on a dial-up line to his data processor. 

It is evident that the control data structure described above Th c artist uses some image creation application, such as 

is but one example. The control data structure may be Adobe's Photoshop to create his image. The artist then saves 

defined in many different ways with different control ele- the image to file in an appropriate format for distribution, 

menls. For example, the partitioning of the control data in such as Ihe Graphical Interchange Format (GIF). The artist 
header data and usage data is not mandatory. Furthermore, 45 then starts his data packaging program and enters an object 

the control elements mentioned above are but examples. The identifier, a title, a format code and a security code, which 

control data format may be unique, e.g. different for different in this example are "123456789", "image", "a", and "b", 

data providers, or defined according to a standard. respectively. In this example, the format code "a" indicates 

The Operation of the Data Packaging Program that no format code need be applied, and this code is selected 
The operation of a first embodiment of the data packaging 50 since the GIF formal is appropriate and already compressed, 

program will now be described with reference to the block Furthermore, the security code "b" indicates that no security 

diagram of FIG. 3 and the flow diagram of FIG. 4. module need be applied and this code is selected since the 

First a data provider creates a data object and saves it to security achieved by the encryption performed by means of 

a file, step 401. When the data packaging program is started, the encryption module 305 is considered appropriate by the 
step 402, the user interface module 302 prompts the data 55 artist. 

object provider to input, step 403, the header information Then the artist enters his dial-up phone number, his price 

consisting of e.g. an object identifier, a title of the data for a single use of the image and for unlimited use of the data 

object, a format code specifying any formal module to be object, a code for usage types approved, and for number of 

used for converting the format of the data object, and a usages approved. For this purpose, the user interface module 
security code specifying any security module to be used for 60 302 may display a data entry form. 

adding further security to the data object. Furthermore, the The data packaging program 19 creates control data on 

user interface module 302 prompts the data object provider the basis of the information entered by the artist and stores 

to input usage information, e.g. his conditions for the usage the data in the header file and in the usage data file as shown 

of the data object. The usage information may comprise the in FIGS. 5 and 6, respectively. This data constitutes a general 

kind of user who is authorized to use the data object, the 65 set of control data which is not specifically adapted to a 

price for different usages of the object etc. The header single user, but which indicates the conditions of usage 

information and the usage information, which may be determined by the artist for all future users. 
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Then the package program 19 concatenates the data object cated therein. The comparison may include comparing ihe 

and the control data in accordance with steps 414-416 of user type, the usage type, the number of usaees, Ihe price etc. 

FIG. 4 to achieve the secure package. No format module or If the requested usage complies with the predetermined 

security module is applied to the data object, since they are conditions the authorization is granted, otherwise it is 
not needed according to the data in tbe header file. 5 rejected. 

When the secure package has been obtained, the artist FIG. 9 is a data flow diagram of the data packaging on the 

sends it to a bulletin board, from where it can be retrieved broker's data processor, which occurs in response to a 

by a user. granted request from a user for authorization for usage of the 

EXAMPLE 2 video, e.g. a granted request for the purchase of two view- 

10 ings. 

Below, another embodiment of the data packaging pro- ] n response to a granted request, the broker again applies 

gram 19 will be described with reference to FIGS. 7-126. In the data packaginc program 19. The general set of control 

this example, the data object consists of a video film, which data 50 and the data object 24 are input to the program from 

is created by a film company and sent to a broker together the control database 20 and the bulk storage 17, respectively 
with tbe predetermined conditions 42 for usage of tbe video. 15 The program creates a user set of control data 60 on the basis 

The broker loads the video 24 to the bulk storage 17 of his 0 f the general set of control data 50 and concatenates the 

data processor. Then, be uses his data packaging program 19 US er set 60 and the data object 24 to create a secure data 

to create a general set of control data 50 based on the package 40, which may then be transferred to the user by any 

predetermined conditions 42 for usage indicated by the film suitable means. A copy of the user set of control data i<; 
company. Furthermore, the address to the video in .the bulk 20 preferably stored in the broker's control database This gives 

storage 17 is stored in an address table in the control the broker a record with which to compare subsequent use 

database 20 or somewhere else in the memory 11. It could e.g. when a dial-up is required for usage 

also be stored in the general set of control data 50. Finally, FIG. 10 is a flow diagram of an exemplary procedure used 

the general set of control data 50 is stored in the control for creating a user set of control data and for packaging the 
database 20. It could also be stored somewhere else m the 2 5 user set of control data and the video into a secure package 

memory 11. After these operations, which correspond to Here, the procedure will be described with reference to the 

steps 401-407 of FIG. 4, the data packaging program is general set of control data shown in FIG. Sa. 

cx ^ tcd The user set of control data 60, i.e. a set of control data 

flG.Sa shows the general set of control data for tbe video which is adapted to the specific user of this example, is 
according to this example. Here the control data includes an 30 created in steps 1001-1003 of FIG. 11. First, tbe general set 

identifier, a format code, a security code, the number of of control data 50 stored in the control database is copied to 

usage elements, the size of the data object, the size of the create new control data, step 1001. Second, a new identifier, 

usage elements and two usage elements, each comprising an here "123456790", which uniquely identifies the user set of 

identifier field, a size field and a data field. The identifier control data, is stored in the identifier field of the new control 
may be a unique number in a series registered for the 35 data 60, step 1002. Third, the data field of the second usage 

particular broker. In this example, the identifier is element is updated with the usage purchased, i.e. in this 

"123456789", the format code "0010", which, in this example with two. since two viewings of the video were 

example, indicates the format of a AV] video and the security purchased, step 1 003. 

code is "0010". Furthermore, the first usage element defines The thus-created user set of control data, which corre- 
the acceptable users for the video and the second usage 40 sponds to the general set of control data of FIG. 8a is shown 

element data defines the number of viewings of the video in FIG. Sb. 

purchased by a user. The first usage element data is 1 which, The user set of control data is stored in the control 

for tbe purposes of this example will signify that only database 20, step 1004. Then, the video, which is stored in 

' education oriented users are acceptable to tbe film company. the bulk storage 17, is copied, step 1005. The copy of the 

The data field of the second usage element data is empty, 4$ video is concatenated with the user set of control data, step 

since at this stage no viewings of the video has been 1006. The security code 0010 specifies that the entire' data 

purchased. package 40 is to be encrypted and that the user program 35 

Managing Object Transfer: must contain a key which can be applied. Accordingly, the 

Tbe broker wants to transfer data objects to users and whole data package is encrypted, step 1007. Finally,' the 

enable controlled usage in return for payment of usage fees 50 encrypted data package is stored on a storage media or 

or royalties. Managing the broker-user business relationship passed to a network program, step 1008, for further transfer 

and negotiating the transaction between the broker and the to the user. 

user can both be automated, and the control data structure FIG. 11 is a memory image of the video 24 and the user 

can provide unlimited support to these operations. The control data 60. The user control data and a copy of the video 

payment can be handled by transmitting credit card 55 24 are concatenated as shown in FIG. 12a. The encrypted 

information, or the user can have a debit or credit account data package 40 is shown in FIG. 12b. 

with the broker which is password activated. Preferably, The procedure of FIG. 10 can be implemented by the data 

payment should be confirmed before the data object is packaging program of FIG. 3. As an alternative to the 

transferred to the user. procedure of FIG. 10, the user set of control data can be 

Data packaging: 60 created as in steps 1001-1003 and saved in a header file and 

When a user wants to use a data object, he contacts the in a usage data file, whereafter steps 408-416 of the data 

broker and requests authorization for usage of the data packaging program of FIG. 4 can be performed to create the 

object. When the request for authorization is received in the secure package. 

broker's data processor, a data program compares the usage The above-described process for creating a user-adapted 

for which authorization is requested with the usage control 65 set of control data may also be used by a user who wants to 

elements of the control data of the data object to see if it redistribute a data object or by a broker who wants to 

complies with the predetermined conditions for usage indi- distribute the data object to other brokers. Obviously, redis- 
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tribution of the data object requires thai redistribution is a A password may be added in a password control element 
usage approved of in the control data of the data object. If during packaging of the data object. The password is trans- 

so, the user or the broker creates a user set of control data ferred to the user by registered mail or in any other appro- 

by adding new control elements and possibly changing the p ri ate way. In response to the presence of the password 

data fields of old control element to reflect the relation 5 CODtro] dement in the control data structure, the user pro- 

between the author and the current user/broker and between mm is ^ mer |0 ^ , ^ password , ^ ^ 

the current user/broker and the future user/broker. In this ord fc red wilb lhc 0 f d - D |he f 

way, an audbt trail is created. a -t .k... ™ . C .u ? 

The User's Data Processor: ? . y match > lhc user P ro S ra na continues, otherwise it 

The user's data processor, which is shown in FIG. 13, is * £f ab ^ cd * 

a general or special purpose processor, preferably with 10 J***™ pr ° r g " m 35 ^ *}*> have P«>ceduies which alter 

network capabilities. It comprises a CPU 25, a memory 26, ^ bchavior of lDe program (e.g. provrie fillers for children) 

and a network adapter 27, which are interconnected by a bus according to the control data of the user object 41. It is 

28. As shown in FIG. 13 : other conventional means, such as important to mention that the user program 35 never stores 

a display 29, a keyboard 30, a printer 31, a sound system 32, &e object in native formal in user accessible storage and thai 

a ROM 33, and a bulk storage device 34, may also be 15 during display of the daia object the print screen key is 

connected to the bus 28. The memory 26 stores network and trapped. 

telecommunications programs 37 and an operating system The file transfer program 1409 can transfer and receive 
(OS) 39. All the above-mentioned elements are well-known files via network to and from other data processor, 
to the skilled person and commercially available. For the Since the data object is repackaged into the secure pack- 
purpose of the present invention, the memory 26 also stores 20 age after the usage, the user program should also include 
a user program 35 and, preferably, a database 36 intended for program code for repackaging the data object. The program 
the control data. Depending upon the current operation, a code could be the same as that used in the corresponding 
daia package 40 can be stored in the memory 26, as shown, data packaging program 19. It could also be a separate 
or in the bulk storage 34. program which is called from the user program. 
The User Program: 25 Operation of the User Program: 

The user program 35 controls the usage of a data object The operation of an embodiment of the user program 35 

in accordance with the control data, which is included in the will now be described with reference to the block diagram 

data package together with the data object. of FIG. 14 and the flow diagram of FIG. 15. 

As shown in FIG. 14. the user program 35 comprises a First the user receives a daia package 40 via file transfer 

program control module 1401 a user interface module 1402, 30 over a network, or on a storage media such as CD-ROM or 

a usage manager module 1403, a control data parser module diskette, or by any other appropriate means, step 1501 . He 

1404, a decryption module 1405, one or more format then stores the data package as a file on his data processor, 

modules 1406, oDe or more security modules 1407, and a file step 1502. 

transfer program 1409. When the user wants to use the data object, he starts the 

The control module 1401 controls the execution of the 35 user program 35, step 1503. Then he requests usage of the 

other modules. The user interface module 1402 handles data object, step 1504. The request is received by ihe user 

interactions with the user. The usage manager module 1403 interface module 1402, which notifies the control module 

unpackages the secure package 40. Ii uses the control data 1401 of the usage request. The control module 1401 calls the 

parser module 1404, the decryption module 1405, the formal usage manager module 1403 and passes the usage request, 

modules 1406, and Ibe security modules 1407. 40 The usage manager module 1403 reads the formal code 

The format modules 1406 comprise program code, which from the data package to determine the control data formal, 

is necessary to handle the daia objecis in their native format, Then it calls Ihe decryption module 1405 to decrypt and 

such as decompression and data format procedures. The extract the control data from ihe data package. The usage 

securily modules 1407 comprises program code required to manager module 1403 applies the decryption module 1405 

implement security above the lowest level, such as access 45 incrementally to decrypt only the control data. Finally, it 

control, usage control and more sophisticated decryption stores the control data in memory, step 1505. 

than what is provided by the basic decryption module 1405. The usage manager module 1403 then calls the control 

The user program 35 can contain many different types of data parser module 1404 to extract the data fields from the 

both format and security modules. However, they should be usage elements. 

complementary with the format and securily modules used 50 The usage manager module 1403 then compares the user 

in the corresponding data packaging program. The usage request for usage with the corresponding control data, steps 

manager module 1401 applies the formal and securily mod- 1506-1507. If the requested usage is not permitted in the 

ules which are necessary to use a data object and which are control data, the requested usage is disabled, step 1508. 

specified in ils control data. If the proper formal and security However, if the requested usage is approved of in the control 
modules are not available for a particular data object, the 55 data, the usage manager module 1403 applies any format 

usage manager module 1401 will not permit any usage. and security modules 1406, 1407 specified in the header data 

The decryption module 1405 can be the above-mentioned or usage data, steps 1509-1514, to the data package. 

FileCrypt Visual Basic subprogram or some other commer- Then the usage manager module 1403 calls the decryption 

cially available decryption program. It can also be a custom module 1405, which decrypts the object data, step 1515, 
designed decryption module. The only restriction is that the 60 whereafter the requested usage is enabled, step 1516. In 

decryption module used in the user program is complemen- connection with the enabling of the usage, the control data 

tary with the encryption module of the data packaging may need to be updated, step 1517. The control data may for 

program. instance comprise a data field indicating a limited number of 

The control data parser module 1403 performs the reverse usages. If so, this data field is decremented by one in 
process of the control data creation module 304 in FIG. 3. 65 response to the enabling of the usage. When the user has 

The user program 35 can have code which controls use of finished usage of the data object, the user program 35 

the program by password or by any other suitable method. restores the daia package in the secure form by repackaging 
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it. step 1518. More particularly, the data object and the usage 
elements are recoocatenated and reencrypted. Then the 
header elements are added and the thus-created package is 
stored in the user's data processor. 

Example 1 contd. 

A specific example of how the user program operates will 
now be described with reference to FIGS. 6 and 15. The 
example is a continuation of Example ] above, where an 
artist created an image and sent it to a bulletin board. 

Assume thai a user has found the image at an electronic 
bulletin board (BBS) and is interested in using it. He then 
loads the data package 40 containing the image to his data 
processor and stores it as a file in the bulk storage. The user 
then executes the user program 35 and requests to preview 
the image. The user program then performs steps 1505-1507 
of the flow diagram in FIG. 15, The request for a preview of 
the image is compared with the data field of the usage 
element "code for usage type approved". In this example, 
the code "9" designates that previews are permitted. Thus, 
the requested preview is OK. Then, the user program 35 
performs step 1509-1515 of FIG. 15. Since the format code 
"a" and the security code "b" of the header data indicate that 
neither conversion, nor decompression, nor security treat- 
ment is required, the user program only decrypts the object 
data. The usage manager module 1403 then displays the 
preview on the user's data processor and passes control back 
to the user interface 1402. 

When the user is finished previewing the image, the user 
interface module 1402 displays the costs for usage of the 
image in accordance with the price usage data of the control 
data ("price for single use" and "price for unlimited use" in 
FIG. 6) and prompts the user to enter a purchase request. The 
user decides to buy unlimited use of the image, and the user 
interface module 1402 inputs purchase information, such as 
an identification, billing, and address for that request and 
passes the request to the control module 1401. The control 
module calls the file transfer program 1409, which dials the 
artist's dial-up number as indicated in the usage data 
("control clement for artist's phone number" in FIG. 6) and 
transfers the request and purchase information to a broker 
program on the artist 's data processor. Upon approval of the 
purchase, the broker program returns a file containing an 
update for "usage type approved" control elements. The 
update is "10" for the usage type approved, which in this 
example indicates that unlimited use by that user is permit- 
ted. The file transfer program 1409 passes this update to the 
usage manager module 1403 which updates the control data 
with the "usage type approved" code. The user interface 
module 1402 then displays a confirmation message to the 
user. 

Subsequently, the user interlace module inputs a request 
to copy the image to a file packaged according to this 
invention, on the user's machine. The usage manager mod- 
ule then compares the user request control data. The usage 
manager module examines the data filed for "Usage type 
approved", which now is "00". The usage manager module 
copies the image to the file. 

When the user is finished with the image, the usage 
manager module 1403 repackages the image as before 
except with updated control data. This repackaging process 
is exactly like that shown in FIG. 4, except that the header 
and usage data already exist, so the process starts after step 
406 where control data is created. 
Improved Security 

If the data object provider wants to improve the security 
of a data package containing a data object, a security module 
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307 containing a sophisticated encryption algorithm, such as 
RSA, could be used. In that case the packaging module 303 
calls the security module 307 in step 412 of the flow diagram 
of FIG. 4. The security module encrypts the image and 
passes a security algorithm code to the control data creation 
module 302, which adds a control element for the security 
module code, which will be delected by the user program 35. 
Then the data packaging continues with step 414. When the 
data package is sent to the user, the public key is mailed to 
the user by registered mail. When the user program is 
executed in response to a request for usage of this data 
object, the usage manager module will detect the security 
module code in the control data and call the security module. 
This module passes control to the user interface module 
1402, which requests the user to input the public key. If the 
key is correct, the user security module applies complemen- 
tary decryption using that key and passes a usage approved 
message to the usage manager module, which enables the 
usage. 

As another example of improved security, a security 
module may implement an authorization process, according 
to which each usage of the data object requires a dialup to 
the data processor of the data object provider. When the 
corresponding security module code is detected by the user 
program 35, the relevant security module is called. This 
module passes a request for authorization to the control 
module 1401, which calls the file transfer program 1409. 
which dial the data object provider's dial-up number, which 
is indicated in a usage element and transfers the request for 
authorization of usage. Upon a granted authorization, the 
30 data provider's data processor returns a usage approved 
message to the user security module, which forwards the 
approval to the usage control module, which enables one 
usage. If the user requests further usages of the data object, 
the authorization process is repeated. This procedures results 
35 in a permanent data object security. 

Example 2 contd. 
A further specific example of how the user program 35 
operates will now be described with reference to FIG. 16. 
40 The example is a continuation of Example 2 above, where 
a user purchased two viewings of a video film from a broker. 

The user wants to play the video which was purchased and 
transferred from the broker. The user applies the user 
program 35, step 1601, and requests to play the video, step 
45 1602. The user program 35 first examines the user set of 
control data 60, step 1603. In this example, the user program 
35 contains only those formal and security modules for 
objects with format code of 0010 and with a security code 
of 0010. Consequently, only those types of data objects may 
50 be used. If the program encounters other codes it will not 
enable the usage action, step 1604-1605. 

Next, the user program 35 compares the first control 
element data which is 1. for educational users only, to user 
information entered by the user on request of the user 
55 program. Since the user type entered by the user is the same 
as that indicated in the first usage element the process 
continues, steps 1606-1607. Then the user program checks 
the second control element data which specifies that the 
number of plays purchased is 2. Consequently, the usage is 
60 enabled, step 1 609. The user program applies the decryption 
module with the universal key and the AVI format video is 
displayed on the display unit 29. Then, the second control 
element data is decremented by one, step 1610. Finally, the 
video is repackaged, step 16U. 
65 Implementation of Variable and Extensible Object Control: 
Object control is achieved through the interaction of the 
data packaging program 19 and the usage program 35 with 
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the conlrol data. Variation of object control can be applied to ADOlher side of composite objects is when the user wants 
a particular object by creating a control data format with to combine data objects for some particular use. Combina- 
control elements defining the control variation and the tion is a usage action thai must be permitted in each 
circumstances in which the variation is applied. Program constituent data object. A new data object is created with 
procedures should then be added to program modules to 5 control data unking the constituent data objects. Each con- 
process the conlrol elements. For example, suppose a broker stituent data object retains its original control data which 
wants to allow studems to print a particular article for free continues to conlrol its subsequent usage, 
but require business users to pay for it. He defines control When a user requests authorization for usage of one 
elements to represent the user types student and business and constituent data object in a composite data object, a user set 
the associated costs for each. He then adds program logic to JQ of control data is created only for that constituent data object 
examine the user type and calculate costs accordingly. and concatenated only with a copy of that constituent data 
Object control is extensible in the sense that the control data object, 
formal can have as many elements as there are parameters Scaleable Implementation: 

defining the rules for object control. The flexible control data structure and modular program 

Implementation of Variable and Extensible Object Security: structure permit almost boundless extensibility with regard 

Object security is also achieved through the interaction of 15 to implementation of the owner's requirements for usage 

the data packaging program 1 9 and the user program 35 with control and royally payment. The control data structure can 

the control data. Security process and encryption/decryption include control elements for complex user types, usage 

algorithms can be added as program modules. Variation of types, multiple billing schemes, artistic or ownership credit 

object security can be applied to a particular object by requirements and others. Security modules can be included 

creating a conlrol data formal with control elements defining 20 which interact with any variation of the control data struc- 

the security variation and ihe circumstances in which the ture and the control data. Security modules could require a 

variation is applied. Program procedures should be added to dial up to the brokers data processor to approve loading or 

program modules to process the conlrol elements. For usage actions and to implement approval authentication 

example, suppose a broker wants to apply minimal security mechanisms, 

to his collection of current news articles but to apply light 25 User Acting as a Broker: 

security to bis encyclopedia and text books. He defines a A limitcd or fall implementation of the broker's data 

control element for security type. He then adds program packaging program can be implemented on the user's 

logic to apply the security algorithms accordingly. Object machine to permit further distribution or reselling. However, 

security is extensible in the sense that multiple levels of data ob J c , cls Wllb co " t 1 ro ! data permitting further 

security can be applied. The level of security will of course 30 ^tnbuUon or reselling arc enabled in that way. 

be dependent on the encryptiorVkey method which is imple- *£S T of a data objecl may wan( t0 aIlow his ori ]na] 

mented id the security modules. One level of security may bfokcr lo dis|ribme his ^ ^ lQ olhef brokcr& ^ 

be to require on-line confirmation when loading a data wilI also distribme nis > He lhen includes a comro] 

object to the user s data processor. This can be implemented eIcmem which enab]es rebro kering in the control data before 

m program code m a secunty module. This permits the 35 distributing the data object with its associated conlrol data to 

broker to check that the object has not already been loaded the original broker. Upon request for rebrokering, the origi- 

as well as double check all other parameters. na l broker copies the general set of control data and updates 

It is also important to have version control with time the copy to create a user set of control data which will 

stamping between the usage program and the user 's control function as the general set of conlrol data on the subsequent 

database. Otherwise the database can be duplicated and 40 brokers daia processor. The original broker packages the 

reapplied to the user program. The user program can place data object with the user set of control data and transfers the 

a time stamp in the control database and in a bidden system package to the subsequent broker. The subsequent broker 

file each time the control database is accessed. If the time then proceeds as if he were an original broker, 

stamps are not identical, the control database has been Automated Transaction Negotiation 

tampered with and all usage is disabled. Program code for 45 This is an example of how the predetermined conditions 

handling time stamps can reside in a security module. for usage included in the control data can be used for 

Handling Composite Objects: achieving automated transaction negotiation. 

A composite object can be handled by defining a control Suppose some company wants lo provide a computer 
data formal with control elements defining relationships automated stock trading. Buy and sell orders could be 
between constituent objects and by defining a parent/child 50 implemented in the form of data packages and a user 
element and a related objecl id element. For example, program could process the data packages and execute trans- 
suppose a broker wants to include a video and a text book actions. Data packages could carry digital cash and manage 
in an educational package. He creates a parenl object with payment based on conditions defined in the control data, 
control elements referring to the video and textbook objects. In this example, the buy order is created using a data 
He also includes control elements in the conlrol data for the 55 packaging program according to the invention on the buy- 
video object and the textbook objecl referring to the parent er's data processor. The sell order is created using the data 
object. Finally, he adds program procedures to program packaging program on the seller's data processor. Both 
modules to process the control elements. orders are used by the user program on the stock trader's 

In other words, when Ihe data objecl is a composite data data processor. The usages would take the form of using a 

object including at least two constituent data objects, a 60 sell order data package to sell stock and a buy order data 

respective general set of control data is created for each of package to buy slock. The rules or conditions for buying and 

the constituent data object and the composite data object. In selling stocks could be indicated in the control data of the 

response to a request from a user, a respective user sel of packages. The data object consists of digital money. In this 

control data is created for each of the constituent data objects context it is important lo remember that digital money is 

as well as for the composite data objecl. 65 merely data which references real money or virtual money 

Examples of various data package structures for compos- that is issued and maintained for the purpose of digital 

ite objects are given in FIG. 17. transactions. 
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In this example the buyer siarts with a digiial money daia 
file. He uses the data packaging program to create control 
data, e.g. kind of stock, price, quantity, for the purchase, and 
he then packages the digital money data file and the control 
data into a secure package as described above. 

The seller starts with an empty data file. This empty file 
is analogous to the digital money data file except it is empty. 
The seller creates control data, e.g. kind of stock, price, 
quantity, and packages the empty file and the control data 
into a secure package. 

Both the sell order package and the buy order package are 
transferred to the data processor of the stock trading 
company, where they are received and stored in the memory. 
The user program of the stock trading company examines 
the control data of the buy and sell order packages in the 
same way as has been described above and looks for a 
match. Upon identifying matched buy and sell orders the 
user program executes a transaction, whereby the digital 
money is extracted from the buy order data package and 
transferred to the sell order package. Then the control data 
of the data packages is updated to provide an audit trail. Both 
packages are repackaged in the same manner as they were 
previously packaged and then transferred back to their 
authors. 

The above described technique could be used for selling 
and buying any object as well as for automated negotiations. 
Payment may be carried out in other ways than by digital 
money. 

In the general case, the data processor of the user decrypts 
the usage control elements of the user sets of control data 
and examines the usage control elements to find a match. In 
response to Ibe finding of a match, the user's data processor 
carries out an action which is specified in the user set of 
control data. 

We claim: 

1. A method for managing a data object so as to comply 
with control conditions for usage of the data object, com- 
prising the steps of: 

storing the data object in a memory device, where it is 
accessible by means of a data object provider's data 
processor; 

providing a variable number of control conditions for 
usage of the data object; 

creating, by said data processor, a general set of control 
data for the data object based on said variable number 
of control conditions for usage, said general set of 
control data comprising at least one or more usage 
control elements defining usages of the data object 
which comply with said variable number of control 
conditions, 

storing said general set of control data in a memory 
device, where it is accessible by said data processor; 

concatenating the general set of control data with a copy 
of the data object; and 

encrypting at least the copy of the data object and said one 
or more usage control elements to create a secure data 
package which is ready for transfer to a user. 

2. A method as set forth in claim 1, wherein the step of 
encrypting comprises encrypting the data object and the 
general set of control data. 

3. A method as set forth in claim 1, wherein the step of 
creating control data comprises creating an identifier which 
uniquely identifies the general set of control data. 

4. A method as set forth in claim 1, wherein the step of 
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5. A method as set forth in claim 1, wherein the step of 
creating a general set of control data comprises creating a 
formal control element which identifies the format of the 
control data. 

5 6. A method as set forth in claim 1, further comprising the 
steps of receiving in said data processor a request for 
authorization for usage by a user; comparing the usage for 
which authorization is requested with said one or more 
usage control elements of the general set of control data and 
to granting the authorization if the usage for which authoriza- 
tion is requested complies" with the usages defined by said 
one or more usage control elements. 

7. A method as set forth in claim 6, further comprising the 
step of securing payment for the requested authorization for 

is usage before granting the authorization. 

8. A method as set forth in claim 1, comprising the further 
steps of: 

receiving the data package in a user's data processor; 
storing the data package in a memory device where it is 

accessible by means of the user's data processor; 
decrypting said one or more usage control elements; 
checking, in response to a request by the user for usage of 
the data object, whether the requested usage complies 
with the usage defined by the at least one usage control 
element of the general set of control data; 
decrypting, in response to the requested usage complying 
with the usage defined by the at least one usage control 
element of the general set of control data, the data 
object and enabling the requested usage, otherwise 
disabling it. 

9. A method as set forth in claim 8, comprising the further 
steps of reconcatenating, after the usage of the data object, 
the data object and the one or more usage control elements, 

35 re encrypting at least the data object and the one or more 
usage control elements, and storing the thus-repackaged data 
package in the memory of the user's data processor. 

10. A method for controlling the usage by a user of a data 
object so as to comply with control conditions for usage of 

40 the data object, comprising the steps of: 

providing a varible number of control conditions for 

usage of the data object; 
storing a data package in a memory device, where it is 
^ accessible by means of a data processor of the user, said 
data package comprising the data object and control 
data, which comprises at least one usage control ele- 
ment defining a usage of the data object which com- 
plies with the variable number of control conditions, 
^ the data object and said at least one usage control 
element being encrypted; 
receiving a request by the user for usage of the data 
object; 

decrypting the control data; 

checking, in response to the request by the user for usage 
of the data object, whether the requested usage com- 
plies with the usage defined by the at least one usage 
control element of the control data; and 
decrypting, in response to the requested usage complying 
with the usage defined by the at least one usage control 
element of the control data, the data object and enabling 
the requested usage, otherwise disabling it. 
11 A method as set forth in claim 10, wherein the usage 
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control element is updated after the at least one usage of the 
creating a general set of control data comprises creating a 65 data object, 
security control element which identifies a security process 12. A method as set forth in claim 10, wherein said control 

to be applied before usage of the data object is allowed. data comprises an indication of the number of times the user 
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is authorized lo use the daia object in accordance with said 
at least one usage control element; 

wherein the requested usage of the data object is only 
enabled when said number of limes is one or more; and 
wherein said number of limes is decremented by one 
when the requested usage is enabled. 

13. A method as set forth in claim 10. wherein the control 
data comprise a security control element, and further com- 
prising the step of carrying out, before each usage of the data 
object, a security procedure defined in the security control 
element. 

14. A method as set forth in claim 10, wherein the step of 
checking whether the requested usage complies with the 
usage defined by the at least one usage control element 
comprises the step of checking that the user's data processor 
is capable of carrying out a security procedure specified in 
a security control element of the at least one usage control 
element, aDd if not, disabling the usage. 

15. A method as set forth in claim 10, comprising the 
further steps of reconcatenating, after the usage of the data 
object, the data object and the one or more usage control 
elements, reencrypting at least the data object and the one or 
more usage control elements, and storing the thus- 
repackaged data package in the memory of the user's data 
processor. 

16. A system for managing a data object so as to comply 
with control conditions for usage of the data object, com- 
prising 

means for providing a vanable number of control condi- 
tions; 

first means in the data object provider's data processor for 
creating a general set of control data for the data object 
based on the variable number of control conditions for 
usage, said general set of control data comprising at 
least one or more usage control elements defining 
usages of the data object which comply with the 
variable number of control conditions; 
storing means, which are accessible by means of said data 
processor, for storing the data object and the general set 40 
of control data; 
concatenating means for concatenating the general set of 

control data with a copy of the data object; and 
encrypting means for encrypting the copy of the data 
object and at least said one or more usage control 
elements to create a secure data package, which is 
ready for transfer to a user. 

17. A system as set forth in claim 16, wherein the general 
set of control data comprises a control data element which 
defines the right to further distribution of the data object by 
the user. 

18. A system for controlling the usage by a user of a data 
object so as to comply with control conditions for usage of 
the data object, comprising: 

means for providing variable number of control condi- 
tions; 

storing means for storing a data package which comprises 
a data object and a control data comprising at least one 
usage control element defying a usage of the data 
object which complies with the variable number of 
control conditions; 

means for decrypting the at least one usage control 
element and the data object; 

checking means for checking whether a usage requested 
by the user complies with the usage defined by said at 
least one usage control element; 
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enabling means for enabling the usage requested by the 
user when the usage complies with the usage defined bv 
said at least one usage control element; and 
disabling means for disabling the usage requested by the 
user when the usage does no! comply with the usage 
defined by said at least one usage control element. 

19. A system as set forth in claim 18, further comprising 
means for repackaging the data object after usage thereof. 

20. A method for controlling the usage by a user of data 
objects so as to comply with predetermined conditions for 
usage of the data objects, comprising the steps of: 

storing at least two data packages in a memory device, 
where they are accessible by a data processor of the 
user, each said data package comprising a data objeel 
and a user set of control data, which comprises at least 
one usage control element defining a usage of the data 
object which complies with the predetermined 
conditions, the data object and said at least one usage 
control elements being encrypted; 
decrypting the usage control elements of the user sets of 
control data; 

examining the usage control elements of said at least two 

data packages to find a match; 
using, in response to the finding of a match, the data 
processor to carry out an action, which is specified in 
the user sets of control data. 

21. A method as set forth in claim 20, comprising the 
further steps of updating the at least one usage control 
element of each data package, concatenating after the usage 
of the data objects, each of the data objects and its at least 

30 one usage control element, reencrypting each of the concat- 
enated data objects and its at least one usage control element 
and transferring the repackaged data objects to their creators. 

22. A method for managing a data object so as to comply 
with predetermined conditions for usage of the data object, 
comprising the steps of: 

storing the data object in a memory device, where it is 
accessible by means of a data object provider's data 
processor; 

providing control conditions for usage of the data object; 
creating, by said data processor, a general set of control 
data for the data object based on said control conditions 
for usage, said general set of control data comprising at 
least one or more usage control elements defining 
usages of the data object which comply with said 
control conditions: 
storing said general set of control data in a memory 
device, where it is accessible by said data processor; 
concatenating the general set of control data with a copy 

of the data object; 
encrypting at least the copy of the data object and said one 
or more usage control elements to create a secure data 
package which is ready for transfer lo a user; 
creating, in response to a request for authorization for 
usage of the data object by a user, a user set of control 
data, which comprises at least a subset of the genera] 
set of control data, including at least one of said usage 
control elements; 
using the user set of control data instead of the general set 

of control data in said concatenating step; 
using the at least one or usage control element of the user 
set of control data instead of the one or more usage 
control elements of the general set of control data in the 
encrypting step: and 
checking, before allowing transfer of the data package lo 
Ihe user, that said request for authorization for usage of 
the data object has been granted. 
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23. A method as set forth io claim 22, wherein the data 
object is composed of at least two constituent data objects 
and wherein the user set of control data, in response to a 
request for authorization for usage of one of said constituent 
data objects by a user, is created only for that constituent 5 
data object and concatenated only with a copy of that 
constituent data object. 

24. A method as set forth in claim 22, wherein the data 
provider's data processor is connected to a data network and 
the request for authorization is received from a data proces- io 
sor of the user, which is also connected to the daia network, 
further comprising the step of transferring the data package 
through the data network to the user's data processor. 

25. A method as set forth in claim 22, wherein the data 
object is a composite data object including at leasi two is 
constituent da la objects and wherein the step of creating a 
general set of control data comprises the step of creating a 
respective general set of control data for each of the con- 
stituent data objects and the composite data objeel and 
wherein the step of creating a user set of control data 20 
comprises the step of creating a respective user set of control 
data for each of the constituent data objects and the com- 
posite data object. 

26. A method as defined in claim 22, comprising the 
further step of storing a copy of the user set of control data 25 
in the data object provider's processor. 

27. A method as defined in claim 22, comprising the 
further steps of: 

receiving the data package in a user's data processor; 

storing the data package in a memory device where it is 30 
accessible by means of the user's data processor; 

decrypting the at least one usage control element of the 
user set of control data; 

checking, in response to a request by the user for usage of 35 
the data object, whether the requested usage complies 
with the usage defined by the at least one usage control 
element of the user set of control data; and 

decrypting, in response to the requesied usage complying 
with the usage defined by the at least one usage control 40 
element of the user set of control data, the data object 
and enabling the requested usage, otherwise disabling 
it. 

28. A method as set forth in claim 22, further comprising: 
receiving the data package in a user's data processor; 45 
storing the data package in a memory device where it is 

accessible by means of the user's data processor; 
decrypting the at least one usage control element of the 
user set of control data; 

50 

checking, in response 10 a request by the user for usage of 
the data object, whether the requested usage complies 


with the usage defined by the at least one usage control 
element of the user set of control data; 
decrypting, in response to the requested usage complying 
with the usage defined by the at least one usage control 
element of the user set of control data, the data objeel 
and enabling the requested usage, otherwise disabling 
it; and 

reconcatenating, after the usage of the data object, the 
data object and the one or more usage control elements 
of the user set of control data, and reencrypting at least 
the data object and the one or more usage of the user set 
of control data. 
29. A system for managing a data objeel so as to comply 
with control conditions for usage of the data object, com- 
prising: 

first means in the data object provider's daia processor for 
creating a general set of control data for the data object 
based on the predetermined conditions for usage, said 
general set of control data comprising at least one or 
more usage control elements defining usages of the data 
object which comply with the predetermined condi- 
tions; 

storing means, which are accessible by means of said data 
processor, for storing the data object and the general set 
of control data; 

concatenating means for concatenating the general set of 
control data with a copy of the data object; 

encrypting means for encrypting the copy of the data 
object and at least said one or more usage control 
elements to create a secure data package, which is 
ready for transfer to a user; 

second means in said data processor for creating, in 
response to a request for authorization for usage of the 
data object by a user, a user set of control data, which 
comprises at least a subset of the general set of control 
data, which subset comprises at least one of said usage 
control elements; 

using the user set of control data instead of the general set 
of control data in the storing means; 

using the user set of control data instead of the general set 
of control data in the concatenating means; 

using the user set of control data instead of the general set 
of control data in the encrypting means; and 

checking means in said data processor for checking that 
said request for authorization for usage of the data 
object has been granted before allowing transfer of the 
data package to the user. 


